Skip to content
ATO Pathways
  Log In

Traditional Security Checklist

Rules, Groups, and Values defined within the XCCDF Benchmark

  • IA-02.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - COOP Plan and Testing (Not in Place for Information Technology Systems or Not Considered in the organizational Holistic Risk Assessment)

    &lt;VulnDiscussion&gt;Failure to develop a COOP and test it periodically can result in the partial or total loss of operations and INFOSEC. A conti...
    Rule Medium Severity
    Show

  • IA-02.03.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - COOP Plan or Testing (Incomplete)

    &lt;VulnDiscussion&gt;Failure to develop a COOP and test it periodically can result in the partial or total loss of operations and INFOSEC. A conti...
    Rule Low Severity
    Show

  • IA-03.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - System Security Incidents (Identifying, Reporting, and Handling)

    &lt;VulnDiscussion&gt;Failure to recognize, investigate and report information systems security incidents could result in the loss of confidentiali...
    Rule Medium Severity
    Show

  • IA-05.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - System Access Control Records (DD Form 2875 or equivalent)

    &lt;VulnDiscussion&gt;If accurate records of authorized users are not maintained, then unauthorized personnel could have access to the system. Fail...
    Rule Medium Severity
    Show

  • IA-06.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - System Training and Certification/ IA Personnel

    &lt;VulnDiscussion&gt;Improperly trained personnel can cause serious system-wide/network-wide problems that render a system/network unstable. REFE...
    Rule Medium Severity
    Show

  • IA-06.02.02

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance/Cybersecurity Training for System Users

    &lt;VulnDiscussion&gt;Improperly trained personnel can cause serious system-wide/network-wide problems that render a system/network unstable. REFE...
    Rule Medium Severity
    Show

  • IA-07.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - Accreditation Documentation

    &lt;VulnDiscussion&gt;Failure to provide the proper documentation can lead to a system connecting without all proper safeguards in place, creating ...
    Rule Medium Severity
    Show

  • IA-10.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - KVM or A/B Switch not listed on the NIAP U.S. Government Approved Protection Products Compliance List (PCL) for Peripheral Sharing Switches

    &lt;VulnDiscussion&gt;Failure to use tested and approved switch boxes can result in the loss or compromise of classified information. REFERENCES: ...
    Rule Medium Severity
    Show

  • IA-10.02.02

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - KVM Switch (Port Separation) on CYBEX/Avocent 4 or 8 port

    &lt;VulnDiscussion&gt;The back plate of some 4 or 8 port CYBEX/AVOCENT KVM devices provides a physical connection between adjacent ports. Therefore...
    Rule Medium Severity
    Show

  • IA-10.02.03

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - KVM Switch Use of Hot-Keys on SIPRNet Connected Devices

    &lt;VulnDiscussion&gt;Use of "Hot Keys" for switching between devices relies on use of software to separate and switch between the devices. Unless...
    Rule Medium Severity
    Show

  • IA-10.03.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - Authorizing Official (AO) and DoDIN Connection Approval Office (CAO) Approval Documentation for use of KVM and A/B switches for Sharing of Classified and Unclassified Peripheral Devices

    &lt;VulnDiscussion&gt;Failure to request approval for connection of existing or additional KVM or A/B devices (switch boxes) for use in switching b...
    Rule Low Severity
    Show

  • IA-11.01.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - Unauthorized Wireless Devices - Portable Electronic Devices (PEDs) Used in Classified Processing Areas without Certified TEMPEST Technical Authority (CTTA) Review and Authorizing Official (AO) Approval.

    &lt;VulnDiscussion&gt;Allowing wireless devices in the vicinity of classified processing or discussion could directly result in the loss or comprom...
    Rule Medium Severity
    Show

  • IA-11.03.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - Unauthorized Wireless Devices - No Formal Policy and/or Warning Signs

    &lt;VulnDiscussion&gt;Not having a wireless policy and/or warning signs at entrances could result in the unauthorized introduction of wireless devi...
    Rule Low Severity
    Show

  • IA-12.01.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - Network Connections - Physical Protection of Network Devices such as Routers, Switches and Hubs (Connected to SIPRNet or Other Classified Networks or Systems Being Inspected)

    &lt;VulnDiscussion&gt;SIPRNet or other classified network connections that are not properly protected in their physical environment are highly vuln...
    Rule High Severity
    Show

  • IA-12.01.02

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - Network Connections - Wall Jack Security on Classified Networks (SIPRNet or other Inspected Classified Network or System) Where Port Authentication Using IEEE 802.1X IS NOT Implemented

    &lt;VulnDiscussion&gt;Following is a summary of the primary requirement to use the IEEE 802.1X authentication protocol to secure SIPRNet ports (AKA...
    Rule High Severity
    Show

  • IA-12.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Assurance - Network Connections - Physical Protection of Unclassified (NIPRNet) Network Devices such as Routers, Switches and Hubs

    &lt;VulnDiscussion&gt;Unclassified (NIPRNet) network connections that are not properly protected in their physical environment are highly vulnerabl...
    Rule Medium Severity
    Show

  • ID-01.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Industrial Security - DD Form 254

    &lt;VulnDiscussion&gt;Failure to complete a DD Form 254 (Contract Security Classification Specification) or to specify security clearance and/or IT...
    Rule Medium Severity
    Show

  • ID-02.03.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Industrial Security - Contractor Visit Authorization Letters (VALs)

    &lt;VulnDiscussion&gt;Failure to require Visit Authorization Letters (VALs) for contractor visits could result in sensitive or classified materials...
    Rule Low Severity
    Show

  • ID-03.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Industrial Security - Contract Guard Vetting

    &lt;VulnDiscussion&gt;Failure to screen guards could result in employment of unsuitable personnel who are responsible for the safety and security o...
    Rule Medium Severity
    Show

  • IS-01.02.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Security (INFOSEC) - Safe/Vault/Secure Room Management

    &lt;VulnDiscussion&gt;Lack of adequate or Improper procedures for management of safes/vaults and secure rooms could result in the loss or compromis...
    Rule Medium Severity
    Show

  • IS-02.01.01

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Door Combination Lock Meeting Federal Specification FF-L-2740

    &lt;VulnDiscussion&gt;Failure to meet Physical Security storage standards could result in the undetected loss or compromise of classified material....
    Rule High Severity
    Show

  • IS-02.01.02

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Security (INFOSEC) - Secure Room Storage Standards - Door Construction

    &lt;VulnDiscussion&gt;Failure to meet construction standards could result in the undetected loss or compromise of classified material. REFERENCES:...
    Rule High Severity
    Show

  • IS-02.01.03

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Security (INFOSEC) - Secure Room Storage Standards Wall and Ceiling Structural Integrity (AKA: True Floor to True Ceiling Connection)

    &lt;VulnDiscussion&gt;Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room...
    Rule High Severity
    Show

  • IS-02.01.04

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Security (INFOSEC) - Vault/Secure Room Storage Standards - Openings in Perimeter Exceeding 96 Square Inches

    &lt;VulnDiscussion&gt;Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a vault or se...
    Rule High Severity
    Show

  • IS-02.01.05

    <GroupDescription></GroupDescription>
    Group
    Show

  • Information Security (INFOSEC) - Secure Room Storage Standards Windows - Accessible from the Ground Hardened Against Forced Entry and Shielded from Exterior Viewing of Classified Materials Contained within the Area.

    &lt;VulnDiscussion&gt;Failure to meet standards for ensuring that there is structural integrity of the physical perimeter surrounding a secure room...
    Rule High Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules